GeoaCVE Guard

Geoa CVE Guard

Know which vulnerabilities are actually yours.

Merged from the CVE List, GitHub Advisory Database, OSV, CISA KEV and EPSS. Ranked by real danger. Checked against the versions you actually run.

CVE ListGitHub AdvisoryOSVKEV / EPSS

01 Feed

  1. LowCVE-2026-95620CVSS 2.1

    Use-after-free vulnerability in QNetworkAccessManager HTTP/2 support impacts Qt

    CVE-2026-95620 has no exploitation data yet. Impact if it lands: CVSS 2.1…

  2. LowCVE-2026-94263CVSS 4.8

    Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution via Form Success Message

    CVE-2026-94263 has no exploitation data yet. Impact if it lands: CVSS 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

  3. LowCVE-2026-111965CVSS 4.3

    Profile Builder 4.0.0 - 4.0.4 - Subscriber+ Comment reCAPTCHA Bypass

    CVE-2026-111965 has no exploitation data yet. Impact if it lands: CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

  4. LowCVE-2026-105963CVSS 5.1

    Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments

    CVE-2026-105963 has no exploitation data yet. Impact if it lands: CVSS 5.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N).

  5. NotableCVE-2026-16762CVSS 8.7

    Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt

    CVE-2026-16762 has no exploitation data yet. Impact if it lands: CVSS 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/S:P/AU:Y/R:A/RE:L).

  6. NotableCVE-2026-89320CVSS 8.8

    HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrity

    CVE-2026-89320 has no exploitation data yet. Impact if it lands: CVSS 8.8 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N).

  7. ElevatedCVE-2026-25784CVSS 9.3

    bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop

    CVE-2026-25784 has no exploitation data yet. Impact if it lands: CVSS 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

  8. LowCVE-2026-89319CVSS 6.3

    JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocation

    CVE-2026-89319 has no exploitation data yet. Impact if it lands: CVSS 6.3 (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N).

  9. NotableCVE-2026-25716CVSS 7.1

    BlueSpiceUserManager: Missing authorization in REST endpoints for blocking and unblocking users

    CVE-2026-25716 has no exploitation data yet. Impact if it lands: CVSS 7.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N).

  10. LowCVE-2026-89318CVSS 6.9

    JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check)

    CVE-2026-89318 has no exploitation data yet. Impact if it lands: CVSS 6.9 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N).

  11. LowCVE-2026-89317CVSS 6.3

    JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11)

    CVE-2026-89317 has no exploitation data yet. Impact if it lands: CVSS 6.3 (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N).

  12. LowCVE-2026-89316CVSS 6.3

    LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion

    CVE-2026-89316 has no exploitation data yet. Impact if it lands: CVSS 6.3 (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N).

  13. LowCVE-2026-89315CVSS 6.9

    JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix

    CVE-2026-89315 has no exploitation data yet. Impact if it lands: CVSS 6.9 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N).

  14. LowCVE-2026-89314CVSS 6.9

    Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s

    CVE-2026-89314 has no exploitation data yet. Impact if it lands: CVSS 6.9 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N).

  15. LowCVE-2026-89313CVSS 6.3

    JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil

    CVE-2026-89313 has no exploitation data yet. Impact if it lands: CVSS 6.3 (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N).

  16. LowCVE-2026-89312CVSS 6.9

    AesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IV

    CVE-2026-89312 has no exploitation data yet. Impact if it lands: CVSS 6.9 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N).

  17. LowCVE-2025-58403CVSS 5.1

    Reflected Cross-Site Scripting (XSS) in CGM CLININET

    CVE-2025-58403 has no exploitation data yet. Impact if it lands: CVSS 5.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N).

  18. ElevatedCVE-2025-30054CVSS 9.3

    Local Privilege Escalation in CGM CLININET

    CVE-2025-30054 has no exploitation data yet. Impact if it lands: CVSS 9.3 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H).

  19. LowCVE-2025-30053CVSS 6.9

    Missing Authentication in CGM CLININET

    CVE-2025-30053 has no exploitation data yet. Impact if it lands: CVSS 6.9 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N).

  20. NotableCVE-2025-30052CVSS 8.8

    Authentication Bypass via IP Spoofing in CGM CLININET rsyncd

    CVE-2025-30052 has no exploitation data yet. Impact if it lands: CVSS 8.8 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:N).

Showing 20 of 21,061. RSS for this view · JSON via the API